pcap_tools 0.0.8 → 0.0.9

data/README.markdown

@@ -127,3 +127,9 @@ The request and response object have some new attributes
 For the response object body, the following "Content-Encoding" type are honored :
 
 * gzip
+
+# FAQ
+
+* `pcap_tools` found nothing in my pcap_files. Try to remove the wiresark profile, and re launch: `rm -rf $HOME/.wireshark/profiles/pcap_tools`.
+
+

data/bin/pcap_tools

@@ -15,7 +15,7 @@ OptionParser.new do |opts|
   end
 
   opts.on("--tshark_path", "Path to tshark executable") do |x|
-    OPTIONS[:tshark_path] = x
+    OPTIONS[:tshark] = x
   end
 
   opts.on("--one-tcp-stream [index]", Integer, "Display only one tcp stream") do |x|
@@ -26,6 +26,14 @@ OptionParser.new do |opts|
     OPTIONS[:mode] = m
   end
 
+  opts.on("--pdml", "Use pdml file as input instead of pcap") do |x|
+    OPTIONS[:pdml] = true
+  end
+
+  opts.on("--keep_retransmission", "Do not ignore retransmitted packets") do |x|
+    OPTIONS[:keep_retransmission] = true
+  end
+
 end.parse!
 
 def format_time t
@@ -135,7 +143,7 @@ else
 end
 
 ARGV.each do |f|
-  PcapTools::Loader::load_file(f, {:tshark => OPTIONS[:tshark_path]}) do |index, packet|
+  PcapTools::Loader::load_file(f, OPTIONS) do |index, packet|
     processor.inject index, packet
   end
 end

data/lib/pcap_tools/loader.rb

@@ -8,13 +8,14 @@ module PcapTools
 
     class MyParser < ::Ox::Sax
 
-      def initialize block
+      def initialize opts, block
         @current_packet_index = 0
         @current_packet = nil
         @current_processing = nil
         @current_proto_name = nil
         @current_field_name = nil
         @block = block
+        @opts = opts
       end
 
       def attr name, value
@@ -47,6 +48,10 @@ module PcapTools
             @current_packet[:tcp_flags][:ack] = value == "1"
           elsif @current_proto_name == "tcp" && @current_field_name == "tcp.flags.syn"
             @current_packet[:tcp_flags][:syn] = value == "1"
+          elsif @current_proto_name == "tcp" && @current_field_name == "tcp.analysis.retransmission"
+            @current_packet[:tcp_retransmission] = true
+          elsif @current_proto_name == "tcp" && @current_field_name == "tcp.analysis.lost_segment"
+            @current_packet[:tcp_lost_segment] = true
           end
         elsif name == :value
           if @current_proto_name == "fake-field-wrapper" && @current_field_name == "data"
@@ -83,6 +88,9 @@ module PcapTools
             $stderr.puts "Malformed packet #{@current_packet_index}"
             return
           end
+          if @current_packet[:tcp_retransmission] && !@opts[:keep_retransmission]
+            return
+          end
           raise "No data found in packet #{@current_packet_index}, protocols found #{@current_packet[:protos]}" if @current_packet[:data].nil? && @current_packet[:size] > 0
           @current_packet.delete :protos
           @block.call @current_packet_index, @current_packet
@@ -93,27 +101,33 @@ module PcapTools
     end
 
     def self.load_file f, options = {}, &block
-      tshark_executable = options[:tshark] || "tshark"
-      accepted_protocols = ["geninfo", "tcp", "ip", "eth", "sll", "frame", "null"]
-      accepted_protocols += options[:accepted_protocols] if options[:accepted_protocols]
-      profile_name = "pcap_tools"
-      profile_dir = "#{ENV['HOME']}/.wireshark/profiles/#{profile_name}"
-      status = POpen4::popen4("#{tshark_executable} -v") do |stdout, stderr, stdin, pid|
-      end
-      raise "#{tshark_executable} not found" unless status
-      unless File.exist? "#{profile_dir}/disabled_protos"
-        status = POpen4::popen4("#{tshark_executable} -G protocols") do |stdout, stderr, stdin, pid|
-          list = stdout.read.split("\n").map { |x| x.split(" ").last }.reject { |x| accepted_protocols.include? x }
-          FileUtils.mkdir_p profile_dir
-          File.open("#{profile_dir}/disabled_protos", "w") { |io| io.write(list.join("\n") + "\n") }
+      if options[:pdml]
+        f = File.open(f, 'rb')
+        Ox.sax_parse(MyParser.new(options, block), f)
+        f.close
+      else
+        tshark_executable = options[:tshark] || "tshark"
+        accepted_protocols = ["geninfo", "tcp", "ip", "eth", "sll", "frame", "null", "ethertype"]
+        accepted_protocols += options[:accepted_protocols] if options[:accepted_protocols]
+        profile_name = "pcap_tools"
+        profile_dir = "#{ENV['HOME']}/.wireshark/profiles/#{profile_name}"
+        status = POpen4::popen4("#{tshark_executable} -v") do |stdout, stderr, stdin, pid|
         end
-        raise "#{tshark_executable} execution error when listing protocols" unless status.exitstatus == 0
-      end
-      status = POpen4::popen4("#{tshark_executable} -n -C #{profile_name} -T pdml -r #{f}") do |stdout, stderr, stdin, pid|
-        Ox.sax_parse(MyParser.new(block), stdout)
-        $stderr.puts stderr.read
+        raise "#{tshark_executable} not found" unless status
+        unless File.exist? "#{profile_dir}/disabled_protos"
+          status = POpen4::popen4("#{tshark_executable} -G protocols") do |stdout, stderr, stdin, pid|
+            list = stdout.read.split("\n").map { |x| x.split(" ").last }.reject { |x| accepted_protocols.include? x }
+            FileUtils.mkdir_p profile_dir
+            File.open("#{profile_dir}/disabled_protos", "w") { |io| io.write(list.join("\n") + "\n") }
+          end
+          raise "#{tshark_executable} execution error when listing protocols" unless status.exitstatus == 0
+        end
+        status = POpen4::popen4("#{tshark_executable} -n -C #{profile_name} -T pdml -r #{f}") do |stdout, stderr, stdin, pid|
+          Ox.sax_parse(MyParser.new(options, block), stdout)
+          $stderr.puts stderr.read
+        end
+        raise "#{tshark_executable} execution error with file #{f}" unless status.exitstatus == 0
       end
-      raise "#{tshark_executable} execution error with file #{f}" unless status.exitstatus == 0
     end
 
   end

data/lib/pcap_tools/packet_processors/tcp.rb

@@ -20,6 +20,7 @@ module PcapTools
           @streams[stream_index] = {
             :first => packet,
             :data => [],
+            :tcp_lost_segment => false,
           }
         elsif packet[:tcp_flags][:fin] || packet[:tcp_flags][:rst]
           if @streams[stream_index]
@@ -35,6 +36,10 @@ module PcapTools
             packet[:type] = (packet[:from] == @streams[stream_index][:first][:from] && packet[:from_port] == @streams[stream_index][:first][:from_port]) ? :out : :in
             packet.delete :tcp_flags
             @streams[stream_index][:data] << packet if packet[:size] > 0
+            if packet[:tcp_lost_segment]
+              @streams.delete stream_index
+              $stderr.puts "Ignoring tcp stream #{stream_index}, tcp segments are missing"
+            end
           end
         end
       end

data/pcap_tools.gemspec

@@ -2,7 +2,7 @@ require 'rake'
 
 Gem::Specification.new do |s|
   s.name        = 'pcap_tools'
-  s.version     = '0.0.8'
+  s.version     = '0.0.9'
   s.authors     = ['Bertrand Paquet']
   s.email       = 'bertrand.paquet@gmail.com'
   s.summary     = 'Tools for extracting data from pcap files'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pcap_tools
 version: !ruby/object:Gem::Version
-  version: 0.0.8
+  version: 0.0.9
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-11-13 00:00:00.000000000 Z
+date: 2014-11-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: popen4